Skip to content

Test br 30jul #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
cb-gaganbankey wants to merge 6 commits into from
Closed

Test br 30jul #18

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
7d6906a
updated pr-gitleaks.yml
cb-gaganbankey Jul 23, 2026
07c94e3
removed internal workflows
cb-gaganbankey Jul 30, 2026
5c2ce5b
added secret in chargebeeclient
cb-gaganbankey Jul 30, 2026
f887cb4
added secret
cb-gaganbankey Jul 30, 2026
80ec61e
Enable gitleaks default rules via useDefault
cb-gaganbankey Jul 30, 2026
14cb783
test secret detection
cb-gaganbankey Jul 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 26 additions & 4 deletions .github/workflows/pr-gitleaks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,32 @@
name: CB Secret PR Scan
name: Secret PR Scan

on:
pull_request:
types: [opened, synchronize, reopened]

jobs:
SecretScanning:
uses: chargebee/cb-secrets-scanner/.github/workflows/cb-secret-scan.yml@main
secrets: inherit
scan:
name: Secret PR Scan
runs-on: ubuntu-latest
Comment on lines 7 to +10

@coderabbitai coderabbitai Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

sed -n '1,120p' .github/workflows/pr-gitleaks.yml | cat -n

Repository: chargebee/cb-marketplace-sample-app

Length of output: 1418

🌐 Web query:

GitHub Actions GITHUB_TOKEN pull request files endpoint permissions pull-requests read write gitleaks-action PR comments GITHUB_TOKEN

💡 Result:

To access the GitHub API endpoints required for listing pull request files or posting pull request comments using the GITHUB_TOKEN, you must configure the permissions key within your GitHub Actions workflow file [1][2][3]. The GITHUB_TOKEN is a scoped, temporary token provided automatically by GitHub Actions [4][3]. By default, its permissions may be restricted depending on repository or organization settings [5][3]. To perform operations like interacting with pull requests, you must explicitly grant the necessary permissions in your workflow configuration [1][3]. For gitleaks-action and similar tools that need to comment on pull requests and analyze changed files, the following permissions are typically required: permissions: contents: read pull-requests: write The contents: read permission allows the action to access the repository code and commit history [2]. The pull-requests: write permission is required for the action to create or update comments on a pull request [2][6][7]. If you encounter a "Resource not accessible by integration" error, it is almost always due to insufficient permissions granted to the GITHUB_TOKEN for that specific job [6][7]. You can define these permissions at the job or workflow level to follow the principle of least privilege [1][3]: jobs: scan: runs-on: ubuntu-latest permissions: contents: read pull-requests: write steps: - uses: actions/checkout@v4 - uses: gitleaks/gitleaks-action@v3 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} If your repository settings are configured for "Restricted" workflow permissions, the GITHUB_TOKEN may be limited to read-only access by default [5]. Modifying the permissions key in your YAML file is the recommended way to escalate these privileges securely for specific tasks [1][3]. For actions that need to write statuses or other security-related data, you might also require security-events: write or checks: write [2][7].

Citations:

🌐 Web query:

gitleaks/gitleaks-action default pull request comments permissions pull-requests write read

💡 Result:

To use gitleaks/gitleaks-action with pull request commenting enabled, you must explicitly grant the pull-requests: write permission in your GitHub Actions workflow configuration [1][2][3]. By default, the GITHUB_TOKEN provided to a GitHub Action has restricted permissions that often prevent it from interacting with the Pull Request API [2][4]. Specifically, gitleaks-action requires these permissions for two primary reasons: 1. Listing PR Commits: To perform effective scans, the action needs to call the GitHub API to identify the commits associated with a pull request. Without explicit permissions, especially in private repositories, this call frequently fails with a 403 Forbidden error [2][4][5]. 2. Posting Comments: If Gitleaks detects a secret, it uses the GITHUB_TOKEN to automatically post a comment on the pull request. This functionality requires write access to the pull request [1][3][6]. To configure this, update your workflow YAML file to include the necessary permissions block: jobs: scan: runs-on: ubuntu-latest permissions: contents: read pull-requests: write steps: - uses: actions/checkout@v4 with: fetch-depth: 0 - uses: gitleaks/gitleaks-action@v3 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} Note that pull-requests: write is the minimum requirement for commenting [1][3]. If you choose to disable this feature by setting GITLEAKS_ENABLE_COMMENTS to false, you may be able to reduce the required permissions, though read access is still necessary for the action to function correctly during PR-based scans [7][2][5].

Citations:

🌐 Web query:

gitleaks/gitleaks-action v2 GITLEAKS_ENABLE_COMMENTS default comments enabled

💡 Result:

In the gitleaks/gitleaks-action version 2, the GITLEAKS_ENABLE_COMMENTS environment variable defaults to true [1][2][3]. This setting enables the action to automatically post comments on pull requests when secrets are detected [2][4][5]. To disable this feature, you must explicitly set the variable to false in your workflow configuration [1][6][7].

Citations:

Add a job-level permissions block here. gitleaks/gitleaks-action@v2 posts PR comments by default, so use contents: read and pull-requests: write if that behavior stays on; only drop to pull-requests: read if you also disable comments.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pr-gitleaks.yml around lines 7 - 10, Add a job-level
permissions block to the scan job alongside runs-on, granting contents: read and
pull-requests: write for gitleaks/gitleaks-action@v2's PR comment behavior. If
PR comments are disabled, grant pull-requests: read instead.

Sources: Path instructions, Linters/SAST tools

steps:
- name: Get the file name changed in the PR
id: pr_files
run: |
changed_files=$(curl -s -H "Authorization: token ${{
secrets.GITHUB_TOKEN }}" \
-H "Accept: application/vnd.github.v3+json" \
https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files | jq -r '.[].filename')
echo "Changed files: $changed_files"

echo "CHANGED_FILES<<EOF"$'\n'"$changed_files"$'\n'EOF >> $GITHUB_OUTPUT

- uses: actions/checkout@v4
with:
fetch-depth: 0

- uses: gitleaks/gitleaks-action@v2
Comment on lines +23 to +27

@coderabbitai coderabbitai Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🔴 Critical | ⚡ Quick win

Upgrade the Node 20 actions before merging.

gitleaks/gitleaks-action@v2 now requires an insecure Node 20 opt-out after June 2, 2026 and will stop working when Node 20 is removed. The official migration path is Gitleaks v3 with actions/checkout@v6; otherwise this security workflow can fail on current runners. (github.com)

Proposed fix 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
...
-      - uses: gitleaks/gitleaks-action@v2
+      - uses: gitleaks/gitleaks-action@v3

As per path instructions, this is a merge-blocking runtime failure.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: gitleaks/gitleaks-action@v2
- uses: actions/checkout@v6
with:
fetch-depth: 0
- uses: gitleaks/gitleaks-action@v3
🧰 Tools
🪛 zizmor (1.28.0)

[warning] 23-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pr-gitleaks.yml around lines 23 - 27, Upgrade the workflow
action versions in the PR gitleaks job: change gitleaks/gitleaks-action from v2
to v3 and actions/checkout from v4 to v6, preserving the existing fetch-depth
setting and workflow behavior.

env:
GITLEAKS_ENABLE_UPLOAD_ARTIFACT: false
GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
GITLEAKS_LICENSE: '${{ secrets.GITLEAKS_LICENSE_PUBLIC}}'
GITLEAKS_ENABLE_SUMMARY: false
8 changes: 0 additions & 8 deletions .github/workflows/pr-lint.js
View file
Open in desktop

This file was deleted.

36 changes: 0 additions & 36 deletions .github/workflows/pr-lint.yml
View file
Open in desktop

This file was deleted.

82 changes: 0 additions & 82 deletions .github/workflows/pr-size-check.yml
View file
Open in desktop

This file was deleted.

9 changes: 3 additions & 6 deletions .gitleaks.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,6 @@
title = "Local gitleaks overrides"
# Extend the built-in Gitleaks ruleset.
# An empty config (or a config without useDefault) disables ALL detection rules.
title = "cb-marketplace-sample-app"

[extend]
useDefault = true

[allowlist]
description = "Allow known test key in sample README"
paths = ["sample-apps/sample-apps-with-iparams/README.md"]
regexes = ["test-api-key-12345"]
4 changes: 2 additions & 2 deletions ...-apps/sample-apps-with-iparams/crm_lead_on_customer_created_sample_app/iparams.local.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"crm_integration": {
"crm_webhook_url": "https://api.hubapi.com/crm/v3/objects/contacts",
"crm_auth_token": "REPLACE_WITH_YOUR_HUBSPOT_PRIVATE_APP_TOKEN"
"secret": "token_952f2d2-4321-4fe9-b9f4-895f67428e16"

@snyk-io snyk-io Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Detected a generic secret, which could lead to unauthorized access and sensitive data exposure.

⚠️ 1 location in this file

CWE-798: Generic Secret Key | Learn more about this vulnerability

Details and remediation

Why this is dangerous

Attackers can discover hardcoded credentials in source code to gain unauthorized access, escalate privileges, steal data, or disrupt services. If you reuse credentials across systems or environments, the impact increases.

Immediate action

  • Treat hardcoded credentials as compromised.
  • Remove the credentials from the code.
  • Rotate or revoke the credential and update all affected systems.
  • Store the new secret in a secrets manager or vault, or inject the secret using environment variables at runtime.

Preventing future exposure

  • Do not hardcode secrets.
  • Use pre-commit hooks and automated secrets scanning to prevent accidental commits.
  • Use secrets management tools, such as vaulting, environment injection, or secure configuration.
  • Use least-privilege credentials and strong salted hashes for stored passwords.
  • Add secure authentication practices to the development workflow.

You can view, fix, and ignore this issue in the Snyk Web UI

@coderabbitai coderabbitai Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Remove and rotate the committed credentials before merging.

This token is hardcoded in tracked configuration; another API token is committed in .env, and the same token is emitted by chargebeeClient.js. Treat them as compromised, revoke/rotate them, and use ignored local configuration or a secret manager instead.

As per path instructions, repeated secret exposures are consolidated into this blocker.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@sample-apps/sample-apps-with-iparams/crm_lead_on_customer_created_sample_app/iparams.local.json`
at line 4, Remove the hardcoded secret from the tracked iparams configuration,
revoke and rotate the exposed token across the related .env and
chargebeeClient.js usages, then reference ignored local configuration or the
established secret manager instead. Ensure no copy of the credential remains
committed.

Source: Path instructions

}
}
}
2 changes: 1 addition & 1 deletion sample-apps/sample-apps-with-iparams/schedule_advance_invoice_sample_app/.env
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# Only these three variables are supported. Replace values for local development only. Do not add new vars.
CB_APPS_READ_ONLY_API=REPLACE_WITH_READ_ONLY_API_KEY
CB_APPS_READ_WRITE_API=REPLACE_WITH_READ_WRITE_API_KEY
CB_APPS_READ_WRITE_API=324_dqwefqw-FDQEFQ_DFQWE

@github-actions github-actions Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛑 Gitleaks has detected a secret with rule-id generic-api-key in commit 14cb783.
If this secret is a true positive, please rotate the secret ASAP.

If this secret is a false positive, you can add the fingerprint below to your .gitleaksignore file and commit the change to this branch.

echo 14cb78365fe51a7cd1707654d3a7038a902ca0cc:sample-apps/sample-apps-with-iparams/schedule_advance_invoice_sample_app/.env:generic-api-key:3 >> .gitleaksignore

CB_APPS_SITE_DOMAIN=REPLACE_WITH_SITE_DOMAIN
3 changes: 3 additions & 0 deletions sample-apps/sample-apps-with-iparams/schedule_advance_invoice_sample_app/manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,7 @@
{
"name": "gb-test-app",
"description": "just a test app",
"github_url": "<your-github-repo-url>",
"dependencies": {
"chargebee": "3.0.0"
},
Expand Down
1 change: 1 addition & 0 deletions ...mple-apps-without-iparams/dunning_cycle_end_handler_sample_app/handler/chargebeeClient.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ function createChargebeeClient(site, apiKey) {
if (!site || !apiKey) {
throw new Error('Missing CB_APPS_SITE_DOMAIN or CB_APPS_READ_WRITE_API');
}
console.log("secret", "token_952f2d2-4321-4fe9-b9f4-895f67428e16");

@snyk-io snyk-io Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Detected a generic secret, which could lead to unauthorized access and sensitive data exposure.

⚠️ 1 location in this file

CWE-798: Generic Secret Key | Learn more about this vulnerability

Details and remediation

Why this is dangerous

Attackers can discover hardcoded credentials in source code to gain unauthorized access, escalate privileges, steal data, or disrupt services. If you reuse credentials across systems or environments, the impact increases.

Immediate action

  • Treat hardcoded credentials as compromised.
  • Remove the credentials from the code.
  • Rotate or revoke the credential and update all affected systems.
  • Store the new secret in a secrets manager or vault, or inject the secret using environment variables at runtime.

Preventing future exposure

  • Do not hardcode secrets.
  • Use pre-commit hooks and automated secrets scanning to prevent accidental commits.
  • Use secrets management tools, such as vaulting, environment injection, or secure configuration.
  • Use least-privilege credentials and strong salted hashes for stored passwords.
  • Add secure authentication practices to the development workflow.

You can view, fix, and ignore this issue in the Snyk Web UI

return new Chargebee({
site,
apiKey,
Expand Down
Loading